T08 · Insecure Dependencies
Error
- Location
- SKILL.md:10
- Finding
- Unpinned Remote npm Package Is Installed and Executed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 10–13 **Additional Location**: `QUICKSTART.md`, lines 10–14 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: High ### Vulnerable Code ```markdown ## Prerequisites - Node.js 22+ - Run via npx: `npx @polygonlabs/agent-cli <command>` - Storage: `~/.polygon-agent/` (AES-256-GCM encrypted) ``` The quick-start guide additionally recommends a global installation: ```markdown ## Prerequisites - Node.js 22+ - Run via npx: `npx @polygonlabs/agent-cli <command>` - Or install globally for the shorter `polygon-agent` command: `npm install -g @polygonlabs/agent-cli` ``` ### Technical Analysis The documentation instructs the Agent to retrieve and execute `@polygonlabs/agent-cli` without pinning an exact package version or integrity digest. Depending on local npm behavior and cache state, `npx` can download the current registry release and execute it immediately. Consequently, the effective executable can change after the Skill has been reviewed. A compromised npm account, package registry, maintainer environment, or future malicious release could introduce arbitrary code without any modification to this Skill. Global installation further expands the exposure because the package remains available to later shell sessions. This risk is particularly significant because the package is expected to operate in a context containing wallet credentials, project access keys, encrypted wallet sessions, and authority to broadcast financial transactions. ### Attack Path 1. An attacker compromises the package publisher, publication pipeline, or registry entry for `@polygonlabs/agent-cli`. 2. The attacker publishes a modified release containing malicious install-time or runtime behavior. 3. The Agent follows the Skill and invokes `npx @polygonlabs/agent-cli` or installs the package globally without specifying an audited version. 4. npm retrieves and executes the attacker-cont ...[truncated 905 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a specific audited version, for example: ```bash npx --no-install @polygonlabs/agent-cli ``` after installing an exact version through a lockfile-controlled process. 2. Commit and enforce a package lockfile containing npm integrity hashes. 3. Prefer a project-local installation over global installation. 4. Disable npm lifecycle scripts during installation where they are not required: ```bash npm ci --ignore-scripts ``` 5. Verify the package's provenance, signatures, maintainers, and published checksums before use. 6. Require explicit user approval before downloading or upgrading executable dependencies. 7. Execute wallet tooling in a sandbox with access only to the files and network endpoints required for the requested operation. 8. Separate dependency installation from sessions in which high-value wallet credentials are loaded. ]]>